# CIAudit Docker Compose Security Linter

> CIAudit Docker Compose Security Linter is a paid API for AI agents from ciaudit.genexxis.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Statically audits a docker-compose file for security misconfigurations including privileged containers, host network/pid/ipc, Docker socket mounts, dangerous capabilities, unpinned images, exposed database ports, hardcoded secrets, missing restart policies, and absent memory limits.

## Facts

- Endpoint: POST https://ciaudit.genexxis.com/compose?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ciaudit-docker-compose-security-linter-ed45ba0b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_l5PMZuT6ZgDjp6wiTtgSS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ciaudit-docker-compose-security-linter-ed45ba0b -d '<json body>'
```

Example prompt: Can you audit this docker-compose.yml for security issues? I want to know if any containers are running privileged, if database ports are exposed on all interfaces, if there are hardcoded secrets, or if images are unpinned — here's the file content: [paste YAML].

## When to prefer this

Choose this endpoint when you specifically need to audit a docker-compose file (not a Dockerfile or GitHub Actions workflow). It targets compose-specific risks like multi-service port exposure, inter-service privilege escalation, and shared host namespaces. For Dockerfile linting or GitHub Actions workflow auditing, use the sibling endpoints on the same platform. Prefer this over generic YAML validators when you need actionable security findings with severity scores and fix guidance rather than schema validation.

## Known failure modes

- Content exceeds 100 KB limit — request rejected
- Invalid or unparseable YAML returns a parse error finding
- Non-compose YAML (e.g. Kubernetes manifests) may produce unexpected or empty results
- Missing 'content' field in request body returns a 400 error
- Network timeout if the service is temporarily unavailable

## How this service works

Lint a docker-compose file: privileged, host network/pid/ipc, Docker socket mounts, SYS_ADMIN/ALL capabilities, unpinned images, database ports published on all interfaces, literal secrets, restart policy, memory limits.

## Output

Returns a JSON object containing a numeric security score (0-100), a summary of findings broken down by severity (low/medium/high/total), a list of detailed findings each with an ID, severity, the line number and code snippet where the issue occurs, a human-readable description of why it's a problem, and a suggested fix. Also includes the list of service names parsed from the compose file.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "content": {
   "type": "string",
   "description": "Full text of the file (max 100 KB)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "kind": "compose",
  "score": 68,
  "summary": {
   "low": 4,
   "high": 1,
   "total": 5,
   "medium": 0
  },
  "findings": [
   {
    "id": "db_port_public",
    "fix": "Bind to localhost (\"127.0.0.1:5432:5432\") or drop the ports entry and use the internal network",
    "why": "service db publishes PostgreSQL port 5432 on all host interfaces",
    "line": 13,
    "snippet": "- \"5432:5432\"",
    "severity": "high"
   }
  ],
  "services": [
   "web",
   "db"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ciaudit-docker-compose-security-linter-ed45ba0b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ciaudit.genexxis.com](https://www.zero.xyz/host/ciaudit.genexxis.com/llms.txt)